Forum Discussion

Copper Contributor

Apr 07, 2020

Solved

Is it possible to use Password Hash Sync with Seamless SSO and DUO MFA?

Is it possible to have applications published in Azure Enterprise Applications and use Azure AD password hash sync for authentication but pass off the MFA piece to DUO? Reference: https://docs....

Identity Management

VasilMichev
Apr 08, 2020
Yup, and somewhere else was mentioned that they cannot satisfy the MFA claim either, which is important for some scenarios. In any case, you should check with Duo support as well.

Skipster

Copper Contributor

Apr 08, 2020

doewebYes this is possible. We are doing this now. We have DUO in Azure AD and are using password hash sync

doeweb
Copper Contributor
Apr 08, 2020
Skipster
Hi there,
So you have no ADFS federation, all of it is configured with a Seamless SSO w/password hash sync? Have you experienced any limitations in regards to user experiences?
- Skipster
  Copper Contributor
  Apr 08, 2020
  doewebWe are currently testing using staged rollout for password hash sync. We are using DUO as an MFA provider in Azure, and we are using conditional access policies to force MFA using DUO provider. Its working, however im a little unclear what the limitations are? I read the article you posted, but what scenario would limitations mentioned in the article apply to?
  - doeweb
    Copper Contributor
    Apr 08, 2020
    Check out: https://techcommunity.microsoft.com/t5/azure-active-directory-identity/upcoming-changes-to-custom-controls/ba-p/1144696# there is also people responding to some issues which is why they had to revert back to ADFS. Skipster